Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss
Does XOR affect the entropy of a file?
467 views
Skip to first unread message
michael....@gmail.com
Apr 16, 2012, 9:30:16 PM4/16/12
to
I have looked at a line graph of the block-by-block entropy of a particular binary that I believed to be encrypted with an XOR cipher. When I XOR'd it with what I thought was the key (but likely may not be), I had a graph of the Shannon entropy which was nearly identical to that which I had before.
Does the XOR cipher affect the entropy of a file?
Thanks,
Michael Sabino
Does the XOR cipher affect the entropy of a file?
Thanks,
Michael Sabino
mockturtle
Apr 17, 2012, 5:36:19 AM4/17/12
to
On Tuesday, April 17, 2012 3:30:16 AM UTC+2, Michael Sabino wrote:
> I have looked at a line graph of the block-by-block entropy of a particular binary that I believed to be encrypted with an XOR cipher. When I XOR'd it with what I thought was the key (but likely may not be), I had a graph of the Shannon entropy which was nearly identical to that which I had before.
>
> Does the XOR cipher affect the entropy of a file?
It depends. What do you mean with "XOR cipher"? What is the "unit" used for computing the entropy? (bit, byte, double word, ...) If you mean the cipher where you XOR each byte with a "key" byte and use bytes as blocks, then the XOR do not change the entropy since it just cause a permutation of the byte values.
> I have looked at a line graph of the block-by-block entropy of a particular binary that I believed to be encrypted with an XOR cipher. When I XOR'd it with what I thought was the key (but likely may not be), I had a graph of the Shannon entropy which was nearly identical to that which I had before.
>
> Does the XOR cipher affect the entropy of a file?
>
> Thanks,
>
> Michael Sabino
Greg Rose
Apr 17, 2012, 6:22:56 AM4/17/12
to
In article <806453.762.1334626216281.JavaMail.geo-discussion-forums@vbuo5>,
This is a very subtle question, and it's hard to
answer it when you don't have the correct
understanding in the first place.
The plaintext was some file which presumably had
some sort of redundancy in it (like text or a
program or a picture...), and when you try to
measure the entropy of that file, you would get
some number that is less than the number of bits
in the file.
Now the file is encrypted by XORing it with
another file F1 that is full of random-looking
data (that is, it appears to have full entropy).
The resulting ciphertext will also appear to have
full entropy, assuming that there was no
pre-existing correlation between the plaintext and
F1.
Now you XOR the ciphertext with F2, which is also
full of random-looking data, and isn't correlated
F1. The result is going to be the same as XORing
the plaintext with some third random-looking file
F3, where F3 = F1 XOR F2. F3 will also be
random-looking. So the entropy of this result will
also appear to be high (ie. random looking).
The only way you'll get a result that doesn't
appear to have full entropy is if two of the files
are correlated to each other. Usually this will be
because F1 == F2, and you decrypted. Alternatively
you might have some buggy random file generator
that left you with different (but correlated) F1
and F2.
I don't know if that helped or not.
Greg.
--
answer it when you don't have the correct
understanding in the first place.
The plaintext was some file which presumably had
some sort of redundancy in it (like text or a
program or a picture...), and when you try to
measure the entropy of that file, you would get
some number that is less than the number of bits
in the file.
Now the file is encrypted by XORing it with
another file F1 that is full of random-looking
data (that is, it appears to have full entropy).
The resulting ciphertext will also appear to have
full entropy, assuming that there was no
pre-existing correlation between the plaintext and
F1.
Now you XOR the ciphertext with F2, which is also
full of random-looking data, and isn't correlated
F1. The result is going to be the same as XORing
the plaintext with some third random-looking file
F3, where F3 = F1 XOR F2. F3 will also be
random-looking. So the entropy of this result will
also appear to be high (ie. random looking).
The only way you'll get a result that doesn't
appear to have full entropy is if two of the files
are correlated to each other. Usually this will be
because F1 == F2, and you decrypted. Alternatively
you might have some buggy random file generator
that left you with different (but correlated) F1
and F2.
I don't know if that helped or not.
Greg.
--
Зол Терентьяк
Apr 17, 2012, 6:13:47 AM4/17/12
to
> I have looked at a line graph of the block-by-block entropy of a particular binary that I believed to be encrypted with an XOR cipher.
One time pad?
> Does the XOR cipher affect the entropy of a file?
~maximum entropy which won't change much if you XOR it with anything
which is not related to a file.
0 new messages